kulkarnirohit123/cra-agent

What it solves

CRA-AGENT automates the continuous monitoring and remediation of software vulnerabilities to ensure compliance with the EU Cyber Resilience Act (CRA). It reduces the manual effort required to scan commits, triage security issues, and manage the lifecycle of vulnerability reporting and fixing.

How it works

The system uses a LangGraph-based agentic architecture to orchestrate several specialized agents:

• Monitoring: A Git monitor detects new commits and analyzes diffs to identify changed files.
• Scanning: A Scanner Agent runs SAST, dependency, and secrets scanners (such as semgrep, pip-audit, and gitleaks) on the changes.
• Triage: A Triage Agent uses LLMs to classify the severity and CRA relevance of findings, filtering out known issues via a SQLite suppression store.
• Remediation: A Jira Agent creates tickets for vulnerabilities, while a Fixer Agent can automatically generate fixes and open pull requests.
• Feedback Loop: A FastAPI webhook server listens for Jira updates to either suppress issues or trigger the Fixer Agent.

Who it’s for

Security engineers, DevOps teams, and organizations needing to maintain strict compliance with EU Cyber Resilience Act requirements for software product security.

Highlights

• Autonomous Workflow: Handles the entire pipeline from commit detection to PR generation for fixes.
• CRA Mapping: Directly maps security findings to CRA Annex I and Annex II requirements.
• Multi-Scanner Integration: Combines static analysis, dependency checks, and secret scanning.
• Bi-directional Jira Sync: Creates tickets from scans and triggers agent actions based on Jira ticket transitions.
• EUVD Integration: Synchronizes with the EU Vulnerability Database every four hours.